VPC Flow Logs

What are VPC Flow Logs?

VPC Flow Logs capture metadata about IP traffic in your VPC — source/destination IPs and ports, protocol, bytes, packet counts, and crucially the ACCEPT/REJECT disposition — at the VPC, subnet, or interface level. They record the shape of traffic, not payloads (that’s not packet capture), delivered to CloudWatch Logs or S3 for querying. They are the network complement to CloudTrail: CloudTrail answers “who called which API?”; Flow Logs answer “did packets flow, and were they allowed?”

The two jobs they do

Debugging connectivity: half of “service A can’t reach service B” tickets resolve here. A REJECT in the logs points at a security group or NACL; an ACCEPT outbound with no corresponding return traffic points at a routing or far-side problem; no log entry at all means the packet never arrived — a route table or gateway issue. This one field triages network problems in minutes that otherwise consume hours. Security forensics and detection: unexpected outbound connections to unknown IPs (exfiltration, C2 callbacks), port-scan patterns, traffic to sanctioned regions, and denied-connection spikes all surface in flow analysis — GuardDuty consumes Flow Logs precisely for this.

Operating them without drowning

Flow Logs are voluminous and billable — logging every interface at full fidelity generates enormous volume and cost. The pragmatic posture: enable at the VPC or key-subnet level, ship to S3 for cheap retention, query with Athena on demand rather than streaming everything through CloudWatch, and use custom log formats to capture only needed fields. Rejected-traffic-only filters cut volume when the goal is security signal over full visibility.

What people get wrong

• Expecting payloads — Flow Logs are metadata; deep inspection needs traffic mirroring, a different (heavier) tool.
• Full-fidelity everywhere and a surprising CloudWatch bill; sample and target instead.
• Storing but never querying: like CloudTrail, unqueried logs are theater — pre-build the Athena queries before the incident.

Primary source: AWS VPC Flow Logs documentation

What Flow Logs Capture (and What They Don’t)

VPC Flow Logs record metadata about network traffic — source and destination IP addresses and ports, protocol, byte counts, and whether traffic was accepted or rejected by security group or NACL rules — but critically, they do not capture the actual packet contents or payload data, meaning they’re useful for detecting patterns (unusual traffic volumes, connections to known malicious IP ranges, unexpected open ports) but not for inspecting what data was actually being transmitted. This metadata-only scope is a deliberate design choice balancing security visibility against the cost and privacy implications of capturing full packet contents at scale, and it’s why flow logs are typically used alongside, not instead of, other security tools like a WAF or intrusion detection system that can inspect actual traffic content.